Vendors / Ahsay

Ahsay vulnerabilities being exploited

2 Ahsay flaws were confirmed exploited in the wild in the past 365 days, across 1 product: AhsayCBS. If you run any of them, patch these first.

Added	Exploited vulnerability	Fix by
2026-10-14	CVE-2026-105134 AhsayCBS Ahsay AhsayCBS Command Injection Vulnerability Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.	2026-10-17
2026-10-14	CVE-2026-105133 AhsayCBS Ahsay AhsayCBS Improper Authentication Vulnerability Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.	2026-10-17

Watch my Ahsay software Scan a website All vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.